Wang Yufen f22881de73 netlabel: fix out-of-bounds memory accesses ... In calipso_map_cat_ntoh(), in the for loop, if the return value of netlbl_bitmap_walk() is equal to (net_clen_bits - 1), when netlbl_bitmap_walk() is called next time, out-of-bounds memory accesses of bitmap[byte_offset] occurs. The bug was found during fuzzing. The following is the fuzzing report BUG: KASAN: slab-out-of-bounds in netlbl_bitmap_walk+0x3c/0xd0 Read of size 1 at addr ffffff8107bf6f70 by task err_OH/252 CPU: 7 PID: 252 Comm: err_OH Not tainted 5.17.0-rc7+ #17 Hardware name: linux,dummy-virt (DT) Call trace: dump_backtrace+0x21c/0x230 show_stack+0x1c/0x60 dump_stack_lvl+0x64/0x7c print_address_description.constprop.0+0x70/0x2d0 __kasan_report+0x158/0x16c kasan_report+0x74/0x120 __asan_load1+0x80/0xa0 netlbl_bitmap_walk+0x3c/0xd0 calipso_opt_getattr+0x1a8/0x230 calipso_sock_getattr+0x218/0x340 calipso_sock_getattr+0x44/0x60 netlbl_sock_getattr+0x44/0x80 selinux_netlbl_socket_setsockopt+0x138/0x170 selinux_socket_setsockopt+0x4c/0x60 security_socket_setsockopt+0x4c/0x90 __sys_setsockopt+0xbc/0x2b0 __arm64_sys_setsockopt+0x6c/0x84 invoke_syscall+0x64/0x190 el0_svc_common.constprop.0+0x88/0x200 do_el0_svc+0x88/0xa0 el0_svc+0x128/0x1b0 el0t_64_sync_handler+0x9c/0x120 el0t_64_sync+0x16c/0x170 Reported-by: Hulk Robot <hulkci@huawei.com> Signed-off-by: Wang Yufen <wangyufen@huawei.com> Acked-by: Paul Moore <paul@paul-moore.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2022-03-21 10:59:11 +00:00
..
Kconfig	treewide: replace '---help---' in Kconfig files with 'help'	2020-06-14 01:57:21 +09:00
Makefile	License cleanup: add SPDX GPL-2.0 license identifier to files with no license	2017-11-02 11:10:55 +01:00
netlabel_addrlist.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlabel_addrlist.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlabel_calipso.c	netlabel: remove unused parameter in netlbl_netlink_auditinfo()	2021-05-19 12:27:13 -07:00
netlabel_calipso.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlabel_cipso_v4.c	net: fix NULL pointer reference in cipso_v4_doi_free	2021-08-30 12:23:18 +01:00
netlabel_cipso_v4.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlabel_domainhash.c	netlabel: Fix spelling mistakes	2021-06-07 14:08:30 -07:00
netlabel_domainhash.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlabel_kapi.c	netlabel: fix out-of-bounds memory accesses	2022-03-21 10:59:11 +00:00
netlabel_mgmt.c	netlabel: Fix memory leak in netlbl_mgmt_add_common	2021-06-15 11:19:04 -07:00
netlabel_mgmt.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlabel_unlabeled.c	lsm: security_task_getsecid_subj() -> security_current_getsecid_subj()	2021-11-22 17:52:47 -05:00
netlabel_unlabeled.h	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlabel_user.c	treewide: Replace GPLv2 boilerplate/reference with SPDX - rule 13	2019-05-21 11:28:45 +02:00
netlabel_user.h	lsm: security_task_getsecid_subj() -> security_current_getsecid_subj()	2021-11-22 17:52:47 -05:00